107091954 Layer 3 Message Analysis

Copyright © All rights reserved TA -TC 6250 E01 TECHCOM Consulting

Content

Layer3 Message Analysis


AMR CS Call Phases

BTS

1. Cell search, BCCH decoding &

RACH access

DRNC SRNC CN UE

2. RRC Connection Setup

3. UE <-> CS-CN signalling

4. RAB Set-up

5. UE <-> CS-CN signalling

6. Service Established

7. Branch addition/deletion & active set update

8. Service Released


RRC Connection Set-up Signalling Flow

UE RNC WBTS

Admission

Control

RRC: RRC CONNECTION REQUEST (RACH)

NBAP: RADIO LINK SETUP

REQUEST

NBAP: RADIO LINK SETUP

RESPONSE

RRC: RRC CONNECTION SETUP (FACH)

L1 Sync

NBAP: SYNCH INDICATION

RRC: CONNECTION SETUP COMPLETE (DCH)

ALCAP:

ERQ ALCAP:

ECF FP Downlink

Sync FP Uplink

Sync


UE<–> CS_CN signalling

U

E

WBTS

RNC MGW

MSC / VLR

•Location Update

•Authentication

•Security Mode Setup

•Paging

•Call Setup


PS Call Phase

BTS

1. Cell search, BCCH decoding

& RACH access

DRNC SRNC CN UE

2. RRC Connection Setup

3. GPRS Attach

4. RAB Set-up

5. UE <-> PS-CN signalling (PDP context activation Accept)

7. PS Data Session Established

9. Branch addition/deletion & active set update

10. PS Data Session Released

6. Radio Bearer Reconfiguration

8. State Transitions


GPRS Attach

Direct Transfer: Attach Accept

Uplink Direct Transfer: Identity Response (DCH)

Direct Transfer: Identity Request Downlink Direct Transfer: Common ID (DCH)

UE RNC SGSN Node B

Secuirty Mode Complete (DCH)

Security Mode Command Security Mode Command (DCH)

Uplink Direct Transfer: Authenication and Ciphering Response (DCH) Direct Transfer: Authentication and Ciphering Response

Direct Transfer: Authentication and Ciphering Request Downlink Direct Transfer: Authentication and Ciphering Request (DCH)

SCCP: Connection Confirm

Initial Direct Transfer: GPRS Attach Request (DCH)

Initial UE message : GPRS Attach Request

SCCP: Connection Request

Common ID

Direct Transfer: Identity Response

Downlink Direct Transfer: Location Attach Accept (DCH)

Direct Transfer: Attach Complete Uplink Direct Transfer: Attach Complete (DCH)

RRC Connection

• UE performs cell search and RRC Connection Establishment in the same way as for an

AMR call

• The UE registers with the PS-CN through the GPRS Attach procedure


PDP Context

UE RNC SGSN Node B

Uplink Direct Transfer : Activate PDP context request (DCH) Direct Transfer : Activate PDP context request

RANAP: RAB Assignment Request

RRC: Radio Bearer Setup

Radio Bearer Setup Complete

RAB Assignment Response

Direct Transfer: Activate PDP Context Accept Downlink Direct Transfer : Activate PDP Context Accept (DCH)

Call Established

Measurement Control

Measurement Control

GPRS Attach


Radio Bearer Setup/Complete & RAB Assignment Response

• Once the RANAP: RAB Assignment Request message has been received from PS CN

and RNC has resources to setup the 0/0 kbps RB the RNC sends a RRC: Radio Bearer

Setup message to the UE

• The UE acknowledges the RRC: Radio Bearer Setup message with a RRC: Radio Bearer

Setup Complete message

• Once the radio bearer establishment has been acknowledged, the RNC indicates to the

PS core that the RAB has been established using the RANAP: RAB Assignment

Response message

UE RNC SGSN Node B






GPRS Attach


Radio Bearer Reconfiguration

AAL2SIG:ECF

AAL2SIG:ERQ

Radio Link Reconfigure Ready

UE RNC SGSN Node B

NBAP: Radio Link Reconfigure Prepare






Direct Transfer: Activate PDP Context Accept Downlink Direct Transfer : Activate PDP Context Accept (DCH)

Call Established

Measurement Control

Measurement Control

Measurement Report : e4a

FP: Downlink Sync

FP: Uplink Sync

Radio Link Reconfiguration Commit

RRC: Radio Bearer Reconfiguration (DCH)

RRC: Radio Bearer Reconfiguration Complete (DCH)

Measurement Control

GPRS Attach

Admission Control


HSPA Setup

• HSUPA cannot be established without HSDPA, HSDPA UL return channel is HSUPA

instead of R99

• High level procedure is the same as that for an NRT DCH

• RNC starts by allocation a 0/0kbps connection

• Selection between DCH and E-DCH is then completed when RNC receives the uplink or

downlink capacity request

HSUPA connection can be established

• RRC Idle mode

• directly from CELL_PCH (Cell Update with reason Uplink Capacity Request)

UE RNC SGSN Node B

RRC Establishment

GPRS Attach

RNC completes channel

type selection procedure

PDP Context Activation

Measurement Report : e4a

0/0 kbps DCH

allocated

Uplink capacity request


RRC Services

• Broadcast services

• Paging and Notification services

• Dedicated Control services

• Encapsulation of NAS signaling (CC, SM, MM, GMM, SMS)


RRC States


RRC Procedure


System Information

• Within UTRAN system information is broadcasted with the help of the RRC messages

•System Information,

•Paging Type I, and

•System Information Change Indication.

• Most system information parameters are determined by the RNC. The Node B is informed about the parameters via

the NBAP message BCCH Information. Some system parameters can be made available by the Node B, such as

interference values, which change fast.

• Given the system information, the UE is capable to decide, whether or how to access the PLMN via the existing cell.

• System information is organised in System Information Blocks (SIBs).

•System information is grouped into SIB 1 to SIB 18.

•Each SIB is responsible to carry a specific content. For instance, SIB 12 holds measurement control information

and parameters.

•Depending on the UE‘s RRC state, is reads specific SIBs, and uses the transmitted parameters.

• There is a huge amount of SIBs, which have to be read by the UE. This requires a lot of battery power. Therefore, a

Master Information Block (MIB) was introduced, which gives references and scheduling information about the SIBs.

The MIB is transmitted in every 8th radio frame on the P-CCPCH (on position SFN mod 8 = 0, and with a TTI of 20

ms). For most of the SIBs used within the system, the MIB may carry a value tag. The only exceptions are SIB 15.2,

SIB 15.3 and SIB 16. If a value tag is unchanged, the corresponding system information has not been modified.

Thus, there is no need for the UE to read the SIB. SIB 7 has no value tag. It changes with each occurrence.

Scheduling information is used to inform the UE, where and when a specific system information is transmitted.


System Information

Node B

UTRAN System Information ( )

UE RNC

NBAP: BCCH Information

MIB

value tag M

SIB 1

value tag 1

SIB 2

value tag 2

SIB 3

value tag 3

SIB 18

value tag 18

position on P-CCPCH: SFN mod 8* = 0

TTI: 20 ms

value tag M: range 1..8

SB

value tag N

TS 25.433: NBAP 8.2.16 System Information Update

MIB: Master Information Block

SIB: System Information Block

SFN: System Frame Number


System Information Blocks

• For each SIB, following characteristics were specified:

•Area scope: Where is the value tag valid: within one cell or within a PLMN/ equivalent PLMN?

•UE RRC state: When the SIB is valid?

•UE RRC state: When the SIB is read?

•Scheduling information: At which position is the SIB transmitted and what is its repetition period?

•Modification of system information: Is it indicated by a value tag, or is it timer based?

• The UE receives all SIBs via the BCCH. There is only one exception: SIB 10. If a UE is capable to receive

simultaneously on one S-CCPCH and on one DPCH, then it receives SIB 10 on a FACH.

• Master Information Block (MIB):

•The MIB informs the UE about the supported PLMN types and the PLMN identity.

•The UE finds in the MIB also references to up to maxSIB (=32) SIBs, including their scheduling information and

type.

•A MIB is valid in one cell. If a UE changes the cell, is must read the new cell‘s MIB.

•The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH.

•Its parameter are valid in the same states.

•A change of the MIB information is indicated by a value tag.

• In this course documentation, we only describe the System Information Blocks (SIBs), which are used in NSN‘s RAN,

and SIB 4 and SIB16.



• System Information Block 1 (SIB 1)

•This SIB is used to inform the UE about NAS system information.

•The NAS system information characterises the NAS domains.

•SIB 1 also delivers UE timers and counters, which have to be used by the UE in the RRC idle and RRC

connected mode.

•For instance, a UE in the RRC connected mode uses the timer T305 for periodic cell and URA updates.

•SIB 1 is valid in one PLMN.

• The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH. Its parameter

are valid in the same states, and the the RRC sub-state CELL_DCH.

•If the UE selects a new cell, and the SIB 1 value tag has the same number as in the preceding cell, the same

content is transmitted in this SIB. There is then no necessity for the UE to read this SIB after cell re-selection.


•This SIB contains an URA identity list.

•SIB 2 is read and valid in the RRC sub-state URA_PCH. A change of the SIB 2 information is indicated by a

value tag.


•This SIB contains relevant parameters for cell selection and re-selection.

•It also holds the cell identity and cell restriction data, such as „cell barred“ IEs.

•SIB 3 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode sub-

states CELL_FACH, CELL_PCH and URA_PCH, if SIB 4 is not broadcasted.

•A change of the SIB 3 information is indicated by a value tag.




•This SIB holds mostly the same data fields as SIB 3*, but it is read and valid only, when the UE is in the RRC

connected mode. I.e, this optional SIB is read and valid in the CELL_FACH, CELL_PACH and URA_PCH sub-

state.

• A change of the SIB 4 information is indicated by a value tag.


•The parameters for the configuration of physical channels are broadcasted in this SIB.

•The parameters cover the PICH power offset, the AICH power offset, P-CCPCH, S-CCPCH and PRACH

system information lists.

•SIB 5 must be read and is valid in the RRC idle mode.

•It is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and URA_PCH, if SIB 6 is

not available.



•This SIB holds fast changing parameters. Therefore no value tag is used for it.

•The UE has to read its parameters periodically.

•For that, an expiration timer (Expiration Time Factor) is broadcasted with this message.

•SIB 7 expires at max(32, 8 * Expiration Time Factor).

•Expiration Time Factor can have the values 2times, 4 times, 8 times ... 256 times. Its default value is 1.

•The fast changing parameters transmitted with SIB 7 include the UL interference and dynamic persistence level.

•It is read and valid in all states except for the CELL_DCH sub-state.


System Information

SIB broadcasted information read scope/

modification

MIB

• PLMN types & identities#

• SIB Scheduling information

• SIB references

RRC idle mode,

CELL_FACH, CELL_PCH,

URA_PCH

cell/

value tag

valid

RRC idle mode,


URA_PCH

SIB 1

• NAS information

• UE timers & counters

RRC idle mode,


URA_PCH

PLMN/

value tag

RRC idle mode,

CELL_DCH, CELL_FACH,

CELL_PCH, URA_PCH

SIB 2

• URA identity list

URA_PCH

cell/

value tag

URA_PCH

SIB 4*

• Cell selection & re-

selection parameters for

UEs in the connected mode


URA_PCH

cell/

value tag


URA_PCH

SIB 3*

• Cell selection

and re-selection parameters°

RRC idle mode,

(CELL_FACH, CELL_PCH,

URA_PCH)

cell/

value tag

RRC idle mode,


URA_PCH)

SIB 5*

• Parameters for common

physical channel

configuration

RRC idle mode,

(CELL_FACH,

CELL_PCH, URA_PCH)

cell/

value tag

RRC idle mode,

(CELL_FACH,

CELL_PCH, URA_PCH)

* Read SIB 3 / 5 in Connected Mode if SIB4 / 6 (Connected Mode) not available

# GSM-MAP/ANSI41; MCC+MNC; ° + Cell Access Restrictions

e.g. T305: Periodic Cell/URA Update

T301, 302, 304, 307-317

e.g. CPICH Ec/N0 or CPICH RSCP; Sintrasearch,

Sintersearch, Ssearch,RAT, Qqualmin, Qrxlevmin,..




•This SIB holds measurement control information.

•The UE gets here the relevant date for traffic measurement, intra-frequency measurements, etc.

•SIB 11 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode sub-

states CELL_FACH, CELL_PCH and URA_PCH, if SIB 12 is not broadcasted.

•It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control

message from UTRAN and SIB 12 is not broadcasted.



•SIB 12 transmits measurement control information for UEs in the RRC connected mode.

•If not transmitted, the UEs take the parameters broadcasted with SIB 11.

•If available, SIB 12 is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and

URA_PCH.

•It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control

message from UTRAN. A change of the SIB 12 information is indicated by a value tag.


•RB, TrCH, and PhyCH parameters are broadcasted, which are stored by the UE both in the RRC idle and RRC

connected mode.

•The parameters are used during a handover to UTRAN. Consequently, these parameters stay valid, when the

UE is connected to GSM and GPRS.

•This SIB is valid in all RRC states, and read in all RRC states except for the CELL_DCH. The UE reads and

stores the parameters. A change of the SIB 16 information is indicated by a value tag.



SIB broadcasted information read scope/

modification

SIB 7

Fast changing parameters:

• UL interference level

• Dynamic persistence level

RRC idle mode,


URA_PCH

cell/ max(32, 8 * Expir-‘

ation Time Factor)

valid

RRC idle mode,


URA_PCH

SIB 11

Measurement control

information*

RRC idle mode,


URA_PCH)

cell/

value tag

RRC idle mode,

(CELL_DCH, CELL_FACH,

CELL_PCH, URA_PCH)

SIB 12

• Measurement control

information* for UEs in the

RRC connected mode


URA_PCH

cell/

value tag

CELL_DCH, CELL_FACH,

CELL_PCH, URA_PCH

SIB 16

• RB, TrCH, and PhyCH

parameters for a

GSM/GPRS-UMTS HO

RRC idle mode,


URA_PCH

cell/

value tag

RRC idle mode,


URA_PCH)

(adopted from TS 25.331 RRC)

* e.g. FMCx & HOPx par.; Use of HCS; Ec/N0

orRSCP; Intra-, Inter-Frequency, Inter-RAT meas.

info; Traffic volume meas. Info (e.g. RLC buffer

payload)

Examples of other SIB’s:

SIB 13: ANSI-41 system information

SIB 14: Only for 3.84 Mcps TDD

SIB 15: useful for UE-based or UE-assisted positioning methods

SIB 17: only for TDD

SIB 18: contains PLMN identities of neighbouring cells to be considered

in idle mode as well as in connected mode.

Documents

107091954 Layer 3 Message Analysis